Legal
Privacy Policy
Effective date: 2 September 2026
This Privacy Policy explains what personal data Toras collects when you use the Service, why we collect it, who we share it with, and the choices and rights you have over it. It’s written to describe what Toras actually does today — not a generic template.
1. Introduction
This policy applies to Toras, an architectural and interior design platform for site analysis, 2D drafting, automatic 3D modeling, AI-assisted rendering, and client presentations. It covers the website, the design editor, and our API. It does not cover third-party sites you may reach through links from Toras.
2. Who we are
Toras is operated by Plancast LLC, 1500 N Grant St Ste R, Denver, CO 80203, United States, the data controller responsible for the personal data described in this policy.
3. Information we collect
Account information
When you sign up, our authentication provider, Clerk, collects your email address, first and last name, and profile image. You can sign in with an email address or a Google account.
Project content
The floorplans, 3D models, site analyses, presentations, and files you create or upload — including CAD files (DXF/DWG), images, GLB models, and PDFs.
Billing state
Your plan tier, subscription status, billing period dates, and credit usage. We never see or store your card details — Lemon Squeezy, our payment processor, is the merchant of record for all purchases and handles payment data directly.
Product usage events
We record which parts of the product you use — for example that you opened the 2D editor, the 3D model view, or the render view, and roughly how long you worked in each — together with a short list of outcomes such as a render starting, finishing, or failing. We do not record what you draw or the individual actions you take inside a feature. Each event is a fixed action name plus a small set of technical properties; see Section 4 for what these events deliberately exclude.
Render history
For each render you run, we keep a record of the AI model used, the credits it cost, how long it took, whether it succeeded or failed, and its estimated cost.
Onboarding progress
Which step of the product walkthrough you’ve reached, so we can resume it where you left off.
4. What we don’t collect
Explicitly not collected
- No keystrokes, mouse movement, or session recording/replay.
- No per-tool or per-action events — we don’t record individual walls, openings, or edits, only that a feature was in use and for how long.
- No canvas content, geometry, or file contents in analytics.
- No project or file names in analytics — only identifiers, with values capped in size and restricted to a fixed list of event names and properties.
- Admin and internal testing accounts are excluded from the product-usage event stream.
- No marketing or attribution cookies, ad networks, tracking pixels, or sale of personal data. We don’t currently capture referrer or campaign (UTM) data.
5. How we use your information
We use the information described above to:
- provide the Service — run your account, store and process your project content, and generate 3D models and renders;
- process payments and manage your subscription and credit balance;
- operate and improve the product, using aggregate usage events and render history;
- provide support and respond to your requests; and
- detect, investigate, and prevent fraud, abuse, and security incidents.
6. Legal bases for processing (UK/EU users)
If you’re in the UK or the European Economic Area, we rely on the following legal bases under the UK GDPR / EU GDPR:
- Performance of a contract — account information, project content, and billing state, which we need to provide the Service and process payments you’ve requested.
- Legitimate interests — product usage events and render history, which we use to keep the Service reliable, fix bugs, and understand feature usage, balanced against your right to privacy through the minimisation described in Section 4.
- Legal obligation — where we must keep or disclose data to comply with tax, accounting, or other legal requirements.
7. Who we share data with
We don’t sell your personal data. We share data with the following service providers, only as needed for them to perform their function:
| Provider | Purpose |
|---|---|
| Clerk | Authentication and account records. |
| Lemon Squeezy | Payment processing; merchant of record for all purchases. |
| Cloudflare R2 | File storage for your project files and generated assets. |
| CloudConvert | Converts CAD files between DXF, DWG, and PDF. |
| fal.ai / Atlas Cloud | AI image generation. The image and prompt you submit for a render are sent to whichever provider you choose for that render. |
| RunPod | Reconstructs a 3D model from an image you submit. |
| Sketchfab | Optional — only used if you connect your own Sketchfab account to publish a model there. |
| Sentry | Error monitoring, so we can detect and fix bugs. |
| Vercel | Application hosting. |
| Render | Database hosting. |
Site analysis features look up map, terrain, and building data from OpenStreetMap, AWS terrain tiles, and Overture Maps for a location you specify. These are outbound lookups for that location; we don’t send personal data to them.
We may also disclose data where required by law, to enforce these Terms, or to protect the rights, property, or safety of Toras, our users, or others.
8. International transfers
The service providers listed in Section 7 may process and store data in countries other than your own, including the United States. Where we transfer personal data of UK or EEA users internationally, we take steps intended to ensure it remains protected in line with this policy, using appropriate safeguards required by UK/EU data protection law.
9. Data retention & account deletion
We keep your data for as long as your account is active, so we can provide the Service. You can delete your account at any time.
When you delete your account, we delete your account and project records from our database. Files you uploaded or generated — floorplans, models, renders, and exports stored in Cloudflare R2 — are removed on a separate storage-cleanup schedule rather than instantly at the moment of deletion, so there can be a delay between deleting your account and every stored file being erased. If you need files removed on a specific timeline, contact us using the details in Section 14.
10. Your rights
If you’re in the UK or EEA, you have the right to:
- Access the personal data we hold about you;
- Correct inaccurate or incomplete data;
- Delete your account and associated personal data, subject to Section 9;
- Export your data in a portable format;
- Object to or request that we restrict certain processing based on legitimate interests; and
- Lodge a complaint with your local data protection authority.
Wherever you’re located, you can exercise these rights — including deleting your account — from your account settings, or by contacting us using the details in Section 14.
11. Children’s privacy
Toras is not directed at children, and we don’t knowingly collect personal data from children under 16. If you believe a child has provided us with personal data, contact us using the details in Section 14 and we’ll delete it.
12. Security
We use reasonable technical and organizational measures to protect your data, including encrypted connections and access controls. No method of transmission or storage is perfectly secure, and we can’t guarantee absolute security.
13. Changes to this policy
We may update this policy from time to time. If we make material changes, we’ll notify you — by email, an in-app notice, or by updating the “Effective date” above — before the change takes effect.
14. Contact us
For privacy questions, or to exercise any of the rights in Section 10, contact us at support@toras.design.